Check Point Research has identified three distinct operational clusters associated with the CopperDragon framework, which targets telecommunications and government sectors across Latin America, Asia, and Europe. This year-long investigation revealed that these clusters—SilentDelivery, OceanGate, and DarkWire—share infrastructure and malware code similarities, indicating a coordinated effort by threat actors linked to China.
Understanding CopperDragon
CopperDragon is tracked as a potential digital quartermaster supporting various China-nexus threat actors, including FamousSparrow, Earth Estries, and TropicTrooper. The framework utilizes the Sparrow malware, which has both Windows and Linux variants, to conduct espionage operations. The research highlights how these actors leverage a shared toolset, complicating attribution and response efforts.
Operational Clusters
The investigation categorized the activities into three main clusters, each employing different tactics and targeting specific sectors:
- SilentDelivery: This cluster employs selective watering-hole attacks, primarily in Europe and Asia, using a backdoor known as SquadC. Attackers compromise legitimate websites frequented by their targets, replacing content with fake SSL certificate warnings to lure users into installing malicious software.
- OceanGate: Focused on Asian organizations, this operation begins with compromising internet-facing Linux systems before moving laterally into Windows environments. It utilizes a variant of SparrowDoor and has been observed using various post-exploitation tools.
- DarkWire: Targeting telecommunications providers and government organizations in Latin America, this cluster employs newly identified backdoors, CopperDoor and CopperDNS, to facilitate its operations.
Technical Insights
Each cluster demonstrates unique methodologies and toolsets. For instance, SilentDelivery’s watering-hole attacks involve heavily obfuscated JavaScript that hijacks legitimate websites, while OceanGate’s operations leverage both Linux and Windows environments, showcasing the actors’ versatility. The DarkWire cluster has introduced advanced modular backdoors that utilize DNS tunneling for command and control communications.
Notably, the research uncovered several previously undocumented tools and capabilities within the Sparrow framework, including passive backdoor functionalities and connections to the Melofee backdoor. These findings underscore the evolving nature of the threat landscape and the sophistication of the CopperDragon operations.
Implications for Cybersecurity
The interconnectedness of these clusters highlights the challenges faced by cybersecurity professionals in attributing attacks and implementing effective defenses. The shared infrastructure and toolsets among different threat actors complicate detection and response efforts, necessitating a more nuanced understanding of the threat landscape.
As organizations continue to face sophisticated cyber threats, the findings from Check Point Research serve as a critical reminder of the importance of robust cybersecurity measures and the need for continuous monitoring and adaptation to emerging threats.
For further details on the research, refer to the full report by Check Point Research.
